Legal
Cookie Policy
Northpin INC uses a small set of essential cookies to operate Shotwisp, Google advertising cookies used to measure whether our ads led you here, and cookieless TrackHaven analytics.
Effective and last updated: August 11, 2026
1. What cookies are
Cookies are small text values a website stores in your browser. Similar local technologies may also remember a setting or protect a request. This policy describes the first-party cookies Shotwisp currently sets and why they are necessary.
2. Cookies Shotwisp uses
| Name | Purpose | Duration |
|---|---|---|
| sw_session | Authenticates your account after sign-in. The cookie is HTTP-only, SameSite=Lax, and Secure in production. | Up to 30 days, or until you log out |
| sw_oauth_[provider]_[state/verifier/nonce/next] | Protects Google and GitHub authorization-code sign-in against request forgery and code interception, validates Google identity responses, and returns you to a safe in-app page. | About 10 minutes; cleared after the callback |
| sidebar_state | Remembers whether you prefer the authenticated dashboard sidebar expanded or collapsed. | Up to 7 days |
| _gcl_au, _gcl_aw, and similar _gcl_* cookies | Set by the Google tag (gtag.js) for Google Ads conversion measurement — attributing a sign-up or purchase to an ad you clicked. Governed by Google's privacy policy. | Up to 90 days |
| _th_v, _th_s, and similar _th_* values (browser local storage, not cookies) | Random visitor and session identifiers used by TrackHaven analytics to count visits and understand how the site is used. They contain no name or email and are never sent to advertisers. | Until you clear your browser's site data |
The OAuth cookie pattern produces separate short-lived cookies for Google and GitHub and only the fields needed by that provider. These cookies do not contain your provider password or a retained provider access token.
3. Advertising measurement
Shotwisp loads the Google tag (gtag.js) to measure Google Ads conversions — whether a visit or sign-up followed one of our ads. As part of this, Google may set the _gcl_* cookies above and receive information such as your IP address, the page you visited, and an advertising click identifier. Google processes this data under its own privacy policy. You can control ad personalization at Google Ads Settings and block or delete these cookies in your browser without affecting your ability to use Shotwisp.
4. Analytics
Shotwisp uses TrackHaven, a privacy-focused analytics service, to measure page visits. It does not set cookies; it keeps the random _th_* identifiers above in your browser's local storage and reports the page URL, referrer, and viewport size of a visit. This data is used only to understand how Shotwisp is used and is not shared for advertising. Clearing your browser's site data removes the identifiers, and blocking them does not affect your ability to use Shotwisp.
5. Third-party sites
If you choose Google or GitHub sign-in or open Stripe’s hosted checkout or billing portal, that provider may set cookies on its own domain under its own policy. Northpin does not control third-party-domain cookies. Returning to Shotwisp does not give us access to the contents of those providers’ cookies.
6. Your controls
Most browsers let you inspect, block, or delete cookies. Blocking the session or OAuth cookies can prevent account sign-in, and deleting the session cookie logs the browser out. Blocking the sidebar cookie only prevents that preference from being remembered. You can also log out to end the current authenticated browser session.
7. Changes and contact
We may update this policy when our cookie practices change. We will revise the effective date and provide additional notice where required. Questions can be sent to Northpin INC through the contact form. For broader information about our data practices, read the Privacy Policy.